AuthGuard Request a demo

Windows sign-in

A Windows password is no longer enough on its own.

The AuthGuard agent adds a second factor to Windows sign-in. After the password, the screen shows a six-digit number and the person types it on their phone to approve. Without the phone to hand, an authenticator-app code works instead.

Protect our workstations See how it works
  • Windows 10, 11 and Server
  • Number on screen
  • Offline mode
  • GPO or Intune
Windows · PC-FIN-07illustrative example

Windows screen

Approve on your phone

Open the request on Ana’s Pixel and type this number:

481 927

Expires in 0:52

Phone

Sign in to Windows

PC-FIN-07

481927
Approve
ApprovedWindows session started · recorded in the audit log
  1. Password
  2. Number on screen
  3. Approved on phone
  4. Signed in

Watch

The password, then the phone.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

From the password to the right number.

The credential provider is loaded by the sign-in screen and never touches the network; a local service handles enrolment, sign-ins and updates.

  1. 01 · Password

    Windows goes first

    The password is checked before the phone is contacted. A wrong password never produces a request.

  2. 02 · Number

    Six digits on screen

    The panel shows the number and the name of the person’s phone. The request expires after 60 seconds.

  3. 03 · Phone

    Type and approve

    In the Sign in to Windows request, the person checks the computer’s name, types the number and confirms with biometrics or a PIN.

  4. 04 · Record

    Every attempt counts

    Every attempt is kept in the computer’s history and in the organisation’s audit log: who, when, how and with what outcome.

Illustrative example

A laptop at the airport, with no network.

Marta opens her laptop before boarding and has no connection. Because she has signed in online on this computer before, the panel switches to offline mode and asks for the offline code she keeps in her authenticator app.

The computer policy sets the window, seven days by default, and how many sign-ins are allowed. Remote desktop is different: it always needs a connection to the service, and offline codes do not work for it.

For IT teams

Install, roll out, stay in control.

Installation

One MSI, your channels

  • An MSI for Windows 10, Windows 11 and Windows Server (x64)
  • Roll-out through GPO or Microsoft Intune, with update rings
  • The computer authenticates with its own key, held in the TPM where there is one
  • Works behind TLS-inspecting proxies
Computer policy

Signed, not negotiable

  • Signed by the service: a GPO or local value cannot widen it
  • An offline window of 1 to 30 days
  • A break-glass account that only works offline at the physical console
  • Service accounts that sign in with a password only, by SID
Without the phone

Fallbacks built in

  • An authenticator-app code (TOTP)
  • Per-computer offline codes
  • Recovery through the helpdesk
  • The organisation’s access policy applies to every sign-in

Worth knowing

  • Phone approval needs Android 14 or later; without a phone, use the authenticator-app code.
  • Offline codes and the break-glass account never work for remote sessions.
  • For people in a federated Microsoft 365 domain, Windows sign-in on Entra-joined devices is not supported.
  • A Windows account that is not mapped to a person, or that the policy refuses, gets the same refusal and nothing reaches the phone. The reason is kept in the computer’s history.

In the help centre

Pilot

Start with one pilot computer.

One workstation with its break-glass account defined, then a small group in the Canary ring, then the rest of the organisation.

geral@authguard.pt